See discussions, stats, and author profiles for this publication at: https://www.researchgate.

net/publication/378463041

MongoDB and NoSQL injection and prevention

Research · February 2024

DOI: 10.13140/RG.2.2.29434.67524

CITATIONS READS
0 844

1 author:

Omar Abuali
An-Najah National University
2 PUBLICATIONS 0 CITATIONS

SEE PROFILE

All content following this page was uploaded by Omar Abuali on 24 February 2024.

The user has requested enhancement of the downloaded file.

 MongoDB and NoSQL injection and prevention
Omar Muhannad AbuAli1
1
Network and Information Security, Najah National University

Abstract—With growing the use of NoSQL databases, like And in the another hand there is different ways used or
MongoDB, and knowing the offered Features like handling large suggested for prevent the NoSQL injections, in this paper we
amounts of data, the risk of NoSQL injection becomes a critical discussed 5 of them:
concern. This paper explores the problems and vulnerabilities
that might face NoSQL databases. The study presents four ‚ Web application firewall (WAF).
types of NoSQL injection attacks: Error-based, Union Query, ‚ User-side validation.
JavaScript injection, and Tautologies, also the paper represents ‚ parameterized queries.
a practical example of a Tautologies attack on the OQSAP ‚ Express Mongo Sanitize.
Juice Shop, showing how the manipulation of product reviews
‚ least-privilege model.
is done.To prevent these threats, the paper mentioned five
prevention methods: Web Application Firewall (WAF), User-side ‚ Server-side validation.
validation, Parameterized queries, Express Mongo Sanitize, and The rest of the paper is organized as follows: the paper starts
the Least-privilege model. Each method is discussed in detail for with a literature review in section 2, then the attacks will be
its effectiveness and the drawbacks they could have, and how listed and explained in section 3. Section 4 presents the pre-
security measures can affect the SW performance, moreover, the
paper introduces Server-side validation as a strong secondary vention methods being implemented and tested in some details
defense against NoSQL injection attacks. The findings show the and illustrates the implementation results. Section 5 presents
need for a multi-layered security approach, this would mix many a how security measures can affect the SW performance, then
preventive steps to ensure a good defense against NoSQL injection results in Section 6, The paper is then ends with the conclusion
attacks. The real-life example highlights the successful use of section.
server-side validation to stop the tautologies attack. This gives a
useful example of good safety measures. II. LITERATURE REVIEW
Index Terms—NoSQL Injection, MongoDB, Database security,
Open Web Application Security Project (OWASP), NoSQL In-
A. MongoDB
jection prevention methods MongoDB is an open-source database and one of many
NoSQL database system types identified as document- ori-
I. I NTRODUCTION ented, MongoDB stores data in JSON format style, there are
NoSQL, short for ”non-SQL or non-relational”, refers to a many features of MongoDB, and the most important ones
category of database management systems that differ from tra- are flexibility, scalability, and high-performance data dealing.
ditional relational database systems in significant ways. These MongoDB is considered scheme-less which means that there
systems are designed to handle large volumes of data and are are no relations between the collections that store the data
known for their flexibility, scalability, and high performance in inside. NoSQL databases are also used more in IoT because
the current era of rapid technological advancement, there is an provide an easy way to store this unstructured data. The
increasing need for databases capable of managing the huge collection in MongoDB is a set of documents similar to the
data that companies deal with, so that is what NoSQL DBs normal table in the relational database. MongoDB uses port
offer, organizations also using NoSQL databases like Amazon 27017 by default (Gupta, S. Singh, N. Tomar, D. 2018). And
DynamoDB, Cassandra, Manhattan, MongoDB. “According here is an example of an insert statement in MongoDB and
to OWASP injection has the third position of the top 10 a clear why injection with JSON structured query is more
list in the most critical security risks to web applications.” difficult than SQL:
The NoSQL injection attack works when the web application
db.books.insert({title:‘NoSQL injection’
accepts input so the attacker can send a malicious query or
,author: ‘O. omar’})
command to the database which could give him access to the
database then manipulate the data or drop tables also withdraw B. NoSQL injection in MongoDB
sensitive data from the database, in this way can break the NoSQL stores data in a complex way such as MongoDB
integrity and confidentiality which is from the 3 principles of which stores data in JSON format type, due to that, the
information security, and with NoSQL database there is multi attacker finds it harder to apply NoSQL injection compared
types of attacks can performed, so in this paper we choose to to the normal SQL injection which is known to most of the
talk about four types of attacks and one has been implemented: users. anyway, it is not 100 percent safe as every system
‚ Error-based can be compromised and hacked, however, systems with more
‚ Union Query. complex and protected security are harder to hack than normal
‚ JavaScript injection ones. There are many NoSQL injection attacks, and we will
‚ Tautologies discuss them in the next Section.
 III. N O SQL INJECTION ATTACKS ‚ Requires careful configuration to be effective.
1) Error-based: In this injection, the attacker uses special ‚ Complex and Costly.
NoSQL characters such as ‘"\/$[].> ,then the attacker will ‚ False Positives

send them to the server and waits to check if the server returns 2) User-side validation: User validation refers to the pro-
an error, and that’s how the attacker can know what version cess when user input is checked by the browser without the
and database being used in the website back-end based on the need to send it to the server which gives the user immediate
errors that return from the servers. feedback without the need to refresh the page this is considered
2) Union Query: This attack is more commonly known an advantage, but the reason why we can’t rely on this type
among users as a type of SQL injection attack, but it exists of prevention because:
here, it works when the attacker uses a vulnerable parameter ‚ It can bypass by altering the JavaScript code loaded in
by exploiting it in order to change the returned dataset. There your browser.
are many uses of union queries, however, the most used ones ‚ Using tools like curl.
are authentication bypassing pages as well as data extraction, 3) parameterized queries: parameterized queries are a pow-
still, when it comes to JSON query structure, it is difficult to erful tool for preventing injection attacks but there a drawback
implement in NoSQL databases. to this type of prevention:
3) JavaScript injection: NoSQL databases introduced vul-
‚ Lack of Flexibility.
nerabilities that can allow JavaScript execution in the database,
‚ Extra Development Time.
resulting in compromising illegal data. The process of the
‚ Memory overhead.
injection is applied by passing unsensitized user input to
the queries for injection, this is due to enabling compli- The way how it works is by defining a NoSQL query structure
cated transactions by JavaScript. There are some risks to first and then passing parameters from the user later. In this
NoSQL features that the database presents, which are running way, the developer ensures that an attacker cannot change the
JavaScript execution in the database engines that may cause intent of a query like inserting a NoSQL command into the
a surface attack that is considered dangerous if the user input query parameters. This way makes it very hard for the attacker
field is unsensitized. to inject malicious code because the structure of the query has
4) Tautologies: Here in this attack type which is our been predefined, here is an example:
practical side in this paper, the attacker uses the NoSQL const filter = { name: omar };
operates like $ne or $gt to make the query always return const update = { $set: { age: 23 } };
true when it is sent to the server in this way he can bypass // Update document matching the filter
the authentication like login pages and edit or extract data const result = await
from our server by injecting query statement return always collection.updateOne(filter, update);
true(tautologies), console.log(result);
IV. N O SQL P REVENTION M ETHODS 4) Use Express Mongo Sanitize: Mongo sanitize plays a
NoSQL database as we mentioned it’s not completely middle-ware in the system to prevent the user from sending
protected from security vulnerabilities, including NoSQL in- any input without being sanitized before it is passed to the
jection. the NoSQL injection is a type of attack where the server and gaining unauthorized access to sensitive data, this
attacker injects malicious code into NoSQL data, so in order module works by searching for any keys in the user input
to prevent this type of attack it is importnant to implement the that begin with $ sign or contain a . from the req.body
following techniques: in order to fully remove these keys and associated data from
1) Web application firewall: WAF short for (Web applica- the object, or replace the suspicions characters with another
tion firewall), this type of firewall its works by filtering and allowed ones.
monitoring the HTTP traffic between web applications and 5) least-privilege model: Today most advanced attacks pre-
the internet to prevent attacks like Cross-site forgery, XSS, dominantly exploit privileged credentials, in a way to access
file inclusion, and NoSQL injection, WAF serves as a kind of the super-user and administrator privileges, by limiting the
reverse proxy that shields the server ensuring clients interact user’s privileges in this way we reduce the ability of the user
with it before accessing the server, all this based on a set to gain any unauthorized access to any activity that is not
of rules or policies which is designed to protect the server restricted to it, the propagation of malware is halted by imple-
from application vulnerabilities by filtering the harmful traffic, menting least privilege on endpoints. This prevents malware
based on (the OSI model) WAF is a protocol layer 7 which is attacks, such as NoSQL injection attacks, from leveraging
(application layer), that means is not capable to defend against elevated privileges to gain broader access, move laterally, and
all type of attacks, also this method of mitigating attacks install or execute malware, or inflict damage to the machine.
typically constitutes an integral part of an exhaustive toolbox 6) Server-side validation: In server-side validation it’s a
that altogether gives a wide-ranging coverage against different second line of defense, also considered more reliable and
types of attack, but the ”Cons” of this type of prevention is: secure because it’s under the control of the server this form
‚ Bypassing. of validation offers a higher level of security, it can block
harmful or incorrect data from infiltrating with database, Figure.1, it is taken from Burp Suite tool and what we see
moreover, server-side validation can tap into the database or is a normal request from the website we need to inject, in
other resources, and carry out more intricate or conditional this type of attack the attacker manipulates the id parameter.
validations. so that makes it more difficult and decreases the This tool allows the attacker to modify the request before it
ability to bypass or manipulate it, and because we consider reaches the server. The object is to inject a condition that
the user input cannot be trusted we add this type of defense always evaluates to TRUE(e.g.,using $ne). As a result, the
and validate the input after it is received from the browser, injected condition effectively instructs the server to update
by creating a new function that check the user input from all records where the id is not equal to -1 and set their
server-side. reviews to match the message written by the attacker. so this
could lead to unauthorized modification of multiple records
V. E FFECT S ECURITY MEASURES ON SW PERFORMANCE in the server database, as we can see on Figure.2, the server
In this section we need to keep in mind the performance accepted the injected condition from the attacker and
of the website after we add all these prevention methods to returned HTTP/1.1 200 OK, this is shown on Figure.3.
mitigate of multi-type of attacks may the company or the
server be exposed to, so the security measures in software
can impact the performance, let’s take an e.g:
1) encryption: :This way to protect the confidentiality of
the data but, it introduces computational overhead when it
comes to big amount of data.
2) authentication and authorization: :It will check the
user’s privileges and access but requires more processing, and
may slow down the response times of the system.
3) server and user validation and sanitization: :Is a very
effective way to prevent injection attacks as we did in this
paper but imposes extra computational burden to check the
Fig. 2. The injected condition.
input integrity.
4) resource limitations: :security measures might require
extra hardware capacity, which could conflict with the primary
functions of the software.
There is more but in general, the developer should balance
security and performance to optimize the software perfor-
mance in the same time maintain the security measures, it
is a big challenge for the developer but it is very important
for delivering a secure and efficient user experience

VI. R ESULTS
Our practical attack is manipulated all product reviews in
the website, so we decided to choose OWASP juice-shop for
penetration testing because it provides this type of vulnerabil-
ity ”Tautologies” named (NoSQL reviews manipulating), so Fig. 3. The injection is succeed.
now I will explain how we exploited this type of attack on the
website we mentioned
Here we have our prevention practical solution:

var userId = parseInt(req.body.id);

if (isNaN(userId) || userId == undefined){
return res.status(401).send() }

We added a function in the source code of the website in

the place where the server receives the ID from the user and
checks the received ID by using the “isNaN” function which
refers to not a number, so here the function checks if the ID
received from the user is not a number its return an error
401. What appears in Figure.4, The hacker tried to pass $ne
Fig. 1. Request from the website. operator but the user input was checked by the function we
added on the server-side.
 trieved from https://ieeexplore.ieee.org/
abstract/document/6650259 doi: 10.1109/
icoia.2013.6650259
Khedkar, B. (2024). Nosql injection. https://
medium.com/@BhaktiKhedkar/nosql
-injection-558337ea7d6c. (Accessed: 2024-
02-03)
Limitations of waf. (2024). https://sourcedefense
.com/glossary/limitations-of-waf/. (Ac-
cessed: 2024-02-05)
Mongo nosql injection attack and how to prevent them. (2023).
Fig. 4. Hacker injection failed after we added a function that sanitized the https://medium.com/@huseyin.isik000/
use input in server-side mongo-nosql-injection-attack-and-how
-to-prevent-them-with-nodejs-express
-code-examples-beebae1a3d98. (Accessed:
VII. C ONCLUSION 2024-02-04)
The paper shows many attack methods should the attacker Nilakshi, N. (2024). Express mongo sanitize.
implement on the NoSQL Databases and how can you as a https://javascript.plainenglish.io/
developer protect your system from these attacks by discussing how-to-sanitize-your-express-app
many prevention methods, and by testing the server-side vali- -against-mongodb-injection-cross-site
dation we saw how the best prevention method was the server- -scripting-6a22f4e822aa. (Accessed: 2024-
side validation and how it’s efficient in preventing the NoSQL 02-03)
injection, but it’s not enough to provide fully protect for the Nosql injection. (2024). https://portswigger.net/
database, to ensure a high level of security we mentioned the web-security/nosql-injection. (Accessed:
important to providing more prevention methods and mix them 2024-02-03)
like a least-privilege model, Use Express Mongo Sanitize, Web Nosql injection cheatsheet. (2024). https://nullsweep
application firewall. Finally, the paper discussed how the web .com/nosql-injection-cheatsheet/. (Ac-
application connect be fully secure against NoSQL injection cessed: 2024-02-04)
but using these prevention methods in your application is way Parameterized query in mongodb. (2024). https://
better than leaving it open for intruders www.linkedin.com/pulse/parameterized
-query-mongodb-cyclobold-tech. (Accessed:
R EFERENCES 2024-02-03)
Acharya, D. P. (2023). Mongodb vs mysql. https:// Principle of least privilege. (2020). https://
kinsta.com/blog/mongodb-vs-mysql/. (Ac- www.cyberark.com/what-is/least
cessed: 2024-02-04) -privilege/. (Accessed: 2024-02-04)
Alazmi. (2023). Customizing owasp zap: A proven method Web security testing with burp suite. (2024).
for detecting sql injection vulnerabilities. IEEE. Re- https://www.pluralsight.com/paths/
trieved from https://ieeexplore.ieee.org/ web-security-testing-with-burp-suite.
abstract/document/10132146 doi: 10.1109/ (Accessed: 2024-02-05)
bigdatasecurity-hpsc-ids58521.2023.00028 What is a waf? (2024). https://www.cloudflare
Aliero. (2015). A component based sql injec- .com/learning/ddos/glossary/web
tion vulnerability detection tool. IEEE. Re- -application-firewall-waf/. (Accessed:
trieved from https://ieeexplore.ieee.org/ 2024-02-03)
abstract/document/7475225 doi: 10.1109/ (Analysis and Mitigation of NoSQL Injections, 2024) (What
mysec.2015.7475225 is a WAF?, 2024) (Client-side vs Server-side Validation,
Analysis and mitigation of nosql injections. (2024). 2024) (PARAMETERIZED QUERY IN MONGODB, 2024)
https://www.infoq.com/articles/ (Nilakshi, 2024) (Khedkar, 2024) (NoSQL injection, 2024)
nosql-injections-analysis/. (Accessed: (Alazmi, 2023) (Aliero, 2015) (Djuric, 2013) (Principle of
2024-02-03) Least Privilege, 2020) (Mongo NoSQL injection attack and
Client-side vs server-side validation. (2024). how to prevent them, 2023) (NoSql Injection Cheatsheet, 2024)
https://www.linkedin.com/advice/1/ (Acharya, 2023) (disadvantage of parameterized query, n.d.)
what-advantages-disadvantages-client (Limitations of WAF, 2024) (Web Security Testing with Burp
-side-server-side. (Accessed: 2024-02-03) Suite, 2024)
disadvantage of parameterized query. (n.d.).
Djuric, Z. (2013). A black-box testing tool for de-
tecting sql injection vulnerabilities. IEEE. Re-

View publication stats